Buggy code:
protected static final int SCANNER_STATE_COMMENT = 2 ; protected static final int SCANNER_STATE_PI = 3 ; protected static final int SCANNER_STATE_DOCTYPE = 4 ; protected static final int SCANNER_STATE_ROOT_ELEMENT = 6 ; protected static final int SCANNER_STATE_CONTENT = 7 ; protected static final int SCANNER_STATE_REFERENCE = 8 ; protected static final int SCANNER_STATE_END_OF_INPUT = 13 ; protected static final int SCANNER_STATE_TERMINATED = 14 ; protected static final int SCANNER_STATE_CDATA = 15 ; protected static final int SCANNER_STATE_TEXT_DECL = 16 ; protected static final String NAMESPACES = ( Constants . SAX_FEATURE_PREFIX ) + ( Constants . NAMESPACES_FEATURE ) ; protected static final String NOTIFY_BUILTIN_REFS = ( Constants . XERCES_FEATURE_PREFIX ) + ( Constants . NOTIFY_BUILTIN_REFS_FEATURE ) ; private static final String [ ] RECOGNIZED_FEATURES = new String [ ] { XMLDocumentFragmentScannerImpl . NAMESPACES , VALIDATION , XMLDocumentFragmentScannerImpl . NOTIFY_BUILTIN_REFS , NOTIFY_CHAR_REFS } ; private static final Boolean [ ] FEATURE_DEFAULTS = new Boolean [ ] { null , null , Boolean . FALSE , Boolean . FALSE } ; private static final String [ ] RECOGNIZED_PROPERTIES = new String [ ] { SYMBOL_TABLE , ERROR_REPORTER , ENTITY_MANAGER } ; private static final Object [ ] PROPERTY_DEFAULTS = new Object [ ] { null , null , null } ; private static final boolean DEBUG_SCANNER_STATE = false ; private static final boolean DEBUG_DISPATCHER = false ; protected static final boolean DEBUG_CONTENT_SCANNING = false ; protected XMLDocumentHandler fDocumentHandler ; protected int [ ] fEntityStack = new int [ 4 ] ; protected int fMarkupDepth ; protected int fScannerState ; protected boolean fInScanContent = false ; protected boolean fHasExternalDTD ; protected boolean fStandalone ; protected QName fCurrentElement ; protected XMLDocumentFragmentScannerImpl . ElementStack fElementStack = new XMLDocumentFragmentScannerImpl . ElementStack ( ) ; protected boolean fNamespaces ; protected boolean fNotifyBuiltInRefs = false ; protected XMLDocumentFragmentScannerImpl . Dispatcher fDispatcher ; protected XMLDocumentFragmentScannerImpl . Dispatcher fContentDispatcher = createContentDispatcher ( ) ; protected QName fElementQName = new QName ( ) ; protected QName fAttributeQName = new QName ( ) ; protected XMLAttributesImpl fAttributes = new XMLAttributesImpl ( ) ; protected XMLString fTempString = new XMLString ( ) ; protected XMLString fTempString2 = new XMLString ( ) ; private String [ ] fStrings = new String [ 3 ] ; private XMLStringBuffer fStringBuffer = new XMLStringBuffer ( ) ; private XMLStringBuffer fStringBuffer2 = new XMLStringBuffer ( ) ; private QName fQName = new QName ( ) ; private final char [ ] fSingleChar = new char [ 1 ] ; private ExternalEntity fExternalEntity = new XMLEntityManager . ExternalEntity ( ) ; public XMLDocumentFragmentScannerImpl ( ) { } public void setInputSource ( XMLInputSource inputSource ) throws IOException { } public boolean scanDocument ( boolean complete ) throws IOException , XNIException { } public void reset ( XMLComponentManager componentManager ) throws XMLConfigurationException { } public String [ ] getRecognizedFeatures ( ) { } public void setFeature ( String featureId , boolean state ) throws XMLConfigurationException { } public String [ ] getRecognizedProperties ( ) { } public void setProperty ( String propertyId , Object value ) throws XMLConfigurationException { } public Boolean getFeatureDefault ( String featureId ) { } public Object getPropertyDefault ( String propertyId ) { } public void setDocumentHandler ( XMLDocumentHandler documentHandler ) { } public XMLDocumentHandler getDocumentHandler ( ) { } public void startEntity ( String name , XMLResourceIdentifier identifier , String encoding ) throws XNIException { } public void endEntity ( String name ) throws XNIException { } protected XMLDocumentFragmentScannerImpl . Dispatcher createContentDispatcher ( ) { } protected void scanXMLDeclOrTextDecl ( boolean scanningTextDecl ) throws IOException , XNIException { } protected void scanPIData ( String target , XMLString data ) throws IOException , XNIException { } protected void scanComment ( ) throws IOException , XNIException { } protected boolean scanStartElement ( ) throws IOException , XNIException { } protected void scanAttribute ( XMLAttributes attributes ) throws IOException , XNIException { } protected int scanContent ( ) throws IOException , XNIException { } protected boolean scanCDATASection ( boolean complete ) throws IOException , XNIException { if ( ( fDocumentHandler ) != null ) { fDocumentHandler . startCDATA ( null ) ; } while ( true ) { fStringBuffer . clear ( ) ; <START_BUG> if ( ! ( fEntityScanner . scanData ( "]]" , fStringBuffer ) ) ) { <END_BUG> if ( ( ( fDocumentHandler ) != null ) && ( ( fStringBuffer . length ) > 0 ) ) { fDocumentHandler . characters ( fStringBuffer , null ) ; } int brackets = 2 ; while ( fEntityScanner . skipChar ( ']' ) ) { brackets ++ ; } if ( ( ( fDocumentHandler ) != null ) && ( brackets > 2 ) ) { fStringBuffer . clear ( ) ; for ( int i = 2 ; i < brackets ; i ++ ) { fStringBuffer . append ( ']' ) ; } fDocumentHandler . characters ( fStringBuffer , null ) ; } if ( fEntityScanner . skipChar ( '>' ) ) { break ; } if ( ( fDocumentHandler ) != null ) { fStringBuffer . clear ( ) ; fStringBuffer . append ( "]]" ) ; fDocumentHandler . characters ( fStringBuffer , null ) ; } } else { if ( ( fDocumentHandler ) != null ) { fDocumentHandler . characters ( fStringBuffer , null ) ; } int c = fEntityScanner . peekChar ( ) ; if ( ( c != ( - 1 ) ) && ( isInvalidLiteral ( c ) ) ) { if ( XMLChar . isHighSurrogate ( c ) ) { fStringBuffer . clear ( ) ; scanSurrogates ( fStringBuffer ) ; if ( ( fDocumentHandler ) != null ) { fDocumentHandler . characters ( fStringBuffer , null ) ; } } else { reportFatalError ( "InvalidCharInCDSect" , new Object [ ] { Integer . toString ( c , 16 ) } ) ; fEntityScanner . scanChar ( ) ; } } } } ( fMarkupDepth ) -- ;

Fix:
if ( fEntityScanner . scanData ( "]]" , fStringBuffer ) ) {